The Snort network intrusion detection system is well known for triggering large numbers of false alerts. In addition, it usually only warns of a potential attack without stating what kind of attack it might be. This paper presents a clustering approach for handling Snort alerts more effectively. Central to this approach is the representation of alerts using the Intrusion Detection Message Exchange Format, which is written in XML. All the alerts for each network session are assembled into a single XML document, thereby representing a pattern of alerts. A novel XML distance measure is proposed to obtain the distance between two such XML documents. A classical clustering algorithm, implemented based on this distance measure, is then applied to group the alert patterns into clusters. Our experiment with the MIT 1998 DARPA data sets demonstrates that the clustering algorithm can distinguish between normal sessions that give rise to false alerts and those sessions that contain real attacks, and in about half of the latter cases can effectively identify the name of the attack.
During this past summer (1991), I spent two months on an appointment as visiting researcher at Kansai University, Osaka, Japan, and five weeks at the Laboratory for International Fuzzy Engineering Research (LIFE), in Yokohama. Part of the expenses for the time in Osaka, and all the expenses for the visit at LIFE, were covered by ONR. While there I met with most of the key researchers in both fuzzy systems and case-based reasoning. This involved trips to numerous universities and research laboratories at Matsushita/Panasonic, Omron, and Hitachi Corporations. In addition, I spent three days at the Fuzzy Logic Systems Institute (FLSI), Iizuka, and I attended the annual meeting of the Japan Society for Fuzzy Theory and Research (SOFT-91) in Nagoya. The following report elaborates what I learned as a result of those activities.
Access to the requested content is limited to institutions that have purchased or subscribe to SPIE eBooks.
You are receiving this notice because your organization may not have SPIE eBooks access.*
*Shibboleth/Open Athens users─please
sign in
to access your institution's subscriptions.
To obtain this item, you may purchase the complete book in print or electronic format on
SPIE.org.
INSTITUTIONAL Select your institution to access the SPIE Digital Library.
PERSONAL Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.